Press CTR-C to copy XML [help]


Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

How to read the report | Suppressing false positives | Getting Help: github issues

Project: waffle-jetty

com.github.waffle:waffle-jetty:3.6.0-SNAPSHOT

Scan Information (show all):

Summary

Summary of Vulnerable Dependencies (click to show all)

Dependency Vulnerability IDs Package Highest Severity CVE Count Confidence Evidence Count
asm-9.9.1.jar pkg:maven/org.ow2.asm/asm@9.9.1   0 54
asm-commons-9.9.1.jar pkg:maven/org.ow2.asm/asm-commons@9.9.1   0 58
asm-tree-9.9.1.jar pkg:maven/org.ow2.asm/asm-tree@9.9.1   0 58
caffeine-3.2.3.jar pkg:maven/com.github.ben-manes.caffeine/caffeine@3.2.3   0 33
checker-qual-3.53.0.jar pkg:maven/org.checkerframework/checker-qual@3.53.0   0 44
com.github.waffle:waffle-jna:3.6.0-SNAPSHOT pkg:maven/com.github.waffle/waffle-jna@3.6.0-SNAPSHOT   0 6
ecj-3.44.0.jar pkg:maven/org.eclipse.jdt/ecj@3.44.0   0 36
error_prone_annotations-2.46.0.jar pkg:maven/com.google.errorprone/error_prone_annotations@2.46.0   0 29
j2objc-annotations-3.1.jar pkg:maven/com.google.j2objc/j2objc-annotations@3.1   0 33
jakarta.annotation-api-3.0.0.jar cpe:2.3:a:oracle:projects:3.0.0:*:*:*:*:*:*:* pkg:maven/jakarta.annotation/jakarta.annotation-api@3.0.0   0 Low 42
jakarta.el-3.0.4.jar cpe:2.3:a:eclipse:jakarta_expression_language:3.0.4:*:*:*:*:*:*:* pkg:maven/org.glassfish/jakarta.el@3.0.4   0 Low 46
jakarta.el-api-6.0.1.jar cpe:2.3:a:eclipse:jakarta_expression_language:6.0.1:*:*:*:*:*:*:* pkg:maven/jakarta.el/jakarta.el-api@6.0.1   0 Low 45
jakarta.servlet-api-4.0.2.jar cpe:2.3:a:oracle:java_se:4.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:projects:4.0.2:*:*:*:*:*:*:* 		pkg:maven/jakarta.servlet/jakarta.servlet-api@4.0.2   0 Medium 41
jakarta.servlet.jsp-2.3.6.jar cpe:2.3:a:oracle:jsp:2.3.6:*:*:*:*:*:*:* pkg:maven/org.glassfish.web/jakarta.servlet.jsp@2.3.6   0 Medium 47
jakarta.servlet.jsp-api-4.0.0.jar pkg:maven/jakarta.servlet.jsp/jakarta.servlet.jsp-api@4.0.0   0 45
jakarta.servlet.jsp.jstl-1.2.6.jar cpe:2.3:a:oracle:jsp:1.2.6:*:*:*:*:*:*:* pkg:maven/org.glassfish.web/jakarta.servlet.jsp.jstl@1.2.6   0 Highest 48
jakarta.servlet.jsp.jstl-api-1.2.4.jar cpe:2.3:a:oracle:java_se:1.2.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jsp:1.2.4:*:*:*:*:*:*:* 		pkg:maven/jakarta.servlet.jsp.jstl/jakarta.servlet.jsp.jstl-api@1.2.4   0 Medium 47
jetty-io-12.1.5.jar cpe:2.3:a:eclipse:jetty:12.1.5:*:*:*:*:*:*:*
cpe:2.3:a:jetty:jetty:12.1.5:*:*:*:*:*:*:*
cpe:2.3:a:mortbay_jetty:jetty:12.1.5:*:*:*:*:*:*:* 		pkg:maven/org.eclipse.jetty/jetty-io@12.1.5   0 Highest 33
jetty-server-12.1.5.jar cpe:2.3:a:eclipse:jetty:12.1.5:*:*:*:*:*:*:*
cpe:2.3:a:jetty:jetty:12.1.5:*:*:*:*:*:*:*
cpe:2.3:a:jetty:jetty_http_server:12.1.5:*:*:*:*:*:*:*
cpe:2.3:a:mortbay_jetty:jetty:12.1.5:*:*:*:*:*:*:* 		pkg:maven/org.eclipse.jetty/jetty-server@12.1.5   0 Highest 33
jetty-servlet-api-4.0.6.jar pkg:maven/org.eclipse.jetty.toolchain/jetty-servlet-api@4.0.6   0 26
jna-5.18.1.jar cpe:2.3:a:oracle:java_se:5.18.1:*:*:*:*:*:*:* pkg:maven/net.java.dev.jna/jna@5.18.1   0 Low 48
jna-5.18.1.jar: jnidispatch.dll   0 2
jna-5.18.1.jar: jnidispatch.dll   0 2
jna-5.18.1.jar: jnidispatch.dll   0 2
jna-platform-5.18.1.jar pkg:maven/net.java.dev.jna/jna-platform@5.18.1   0 42
jspecify-1.0.0.jar pkg:maven/org.jspecify/jspecify@1.0.0   0 32
jsr305-3.0.2.jar pkg:maven/com.google.code.findbugs/jsr305@3.0.2   0 17
mortbay-apache-el-9.0.111.jar cpe:2.3:a:eclipse:jetty:9.0.111:*:*:*:*:*:*:*
cpe:2.3:a:jetty:jetty:9.0.111:*:*:*:*:*:*:*
cpe:2.3:a:mortbay:jetty:9.0.111:*:*:*:*:*:*:*
cpe:2.3:a:mortbay_jetty:jetty:9.0.111:*:*:*:*:*:*:* 		pkg:maven/org.mortbay.jasper/mortbay-apache-el@9.0.111 CRITICAL* 18 Low 33
mortbay-apache-jsp-9.0.111.jar cpe:2.3:a:apache:tomcat:9.0.111:*:*:*:*:*:*:* pkg:maven/org.mortbay.jasper/mortbay-apache-jsp@9.0.111   0 Low 36
slf4j-api-2.0.17.jar pkg:maven/org.slf4j/slf4j-api@2.0.17   0 29
spotbugs-annotations-4.9.8.jar pkg:maven/com.github.spotbugs/spotbugs-annotations@4.9.8   0 53

* indicates the dependency has a known exploited vulnerability

Dependencies (vulnerable)

asm-9.9.1.jar

Description:

ASM, a very small and fast Java bytecode manipulation framework

License:

BSD-3-Clause: https://asm.ow2.io/license.html
File Path: /home/runner/.m2/repository/org/ow2/asm/asm/9.9.1/asm-9.9.1.jar
MD5: 1888ad1f49038441bb2d12aa6dffe396
SHA1: 2ceea6ab43bcae1979b2a6d85fc0ca429877e5ab
SHA256:6f3828a215c920059a5efa2fb55c233d6c54ec5cadca99ce1b1bdd10077c7ddd
Referenced In Project/Scope: waffle-jetty:provided
asm-9.9.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.ow2.asm/asm-commons@9.9.1

Identifiers

  • pkg:maven/org.ow2.asm/asm@9.9.1   (Confidence:High)

asm-commons-9.9.1.jar

Description:

Usefull class adapters based on ASM, a very small and fast Java bytecode manipulation framework

License:

BSD-3-Clause: https://asm.ow2.io/license.html
File Path: /home/runner/.m2/repository/org/ow2/asm/asm-commons/9.9.1/asm-commons-9.9.1.jar
MD5: 7e0ef716c43d92d29e666f820df24e2c
SHA1: ab35de4c537184a09339069f1a3b3aacf2289149
SHA256:c2319e014ce7199f2b7f7d56d6bb991863168c3f4b6cd6c9f542a4937ef7ef88
Referenced In Project/Scope: waffle-jetty:provided
asm-commons-9.9.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-jetty@3.6.0-SNAPSHOT

Identifiers

  • pkg:maven/org.ow2.asm/asm-commons@9.9.1   (Confidence:High)

asm-tree-9.9.1.jar

Description:

Tree API of ASM, a very small and fast Java bytecode manipulation framework

License:

BSD-3-Clause: https://asm.ow2.io/license.html
File Path: /home/runner/.m2/repository/org/ow2/asm/asm-tree/9.9.1/asm-tree-9.9.1.jar
MD5: 7eb17cd0d09b03fbe473e51edfc6e4d2
SHA1: b6b1b3366296163b4b1f540731aad0a2baa484d8
SHA256:0f3555096b720b820bbacab0b515589bee0200bee099bda14c561738ae837ba1
Referenced In Project/Scope: waffle-jetty:provided
asm-tree-9.9.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.ow2.asm/asm-commons@9.9.1

Identifiers

  • pkg:maven/org.ow2.asm/asm-tree@9.9.1   (Confidence:High)

caffeine-3.2.3.jar

Description:

A high performance caching library

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/github/ben-manes/caffeine/caffeine/3.2.3/caffeine-3.2.3.jar
MD5: 0258f45d43968523cc11beeb01b240f2
SHA1: c097f0f6d21a0e6db88ea55836e26419b30dfe19
SHA256:ca70c90a5d1ce1511880ce9c93d4ad22108f61111d3daf91eb52762b571bd179
Referenced In Project/Scope: waffle-jetty:compile
caffeine-3.2.3.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-jna@3.6.0-SNAPSHOT

Identifiers

  • pkg:maven/com.github.ben-manes.caffeine/caffeine@3.2.3   (Confidence:High)

checker-qual-3.53.0.jar

Description:

checker-qual contains annotations (type qualifiers) that a programmerwrites to specify Java code for type-checking by the Checker Framework.

License:

The MIT License: http://opensource.org/licenses/MIT
File Path: /home/runner/.m2/repository/org/checkerframework/checker-qual/3.53.0/checker-qual-3.53.0.jar
MD5: d1ee2a3366a19a8fff01208da2adb48e
SHA1: af1105964a03d7ed8aaf8ea2cb6ec0da7ec6c7a6
SHA256:7ca002815d92fad79e966b375c2ee7b2b4bf953024bc9a5d5e0c59df13ff5af8
Referenced In Project/Scope: waffle-jetty:compile
checker-qual-3.53.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-jna@3.6.0-SNAPSHOT

Identifiers

  • pkg:maven/org.checkerframework/checker-qual@3.53.0   (Confidence:High)

com.github.waffle:waffle-jna:3.6.0-SNAPSHOT

Description:

WAFFLE JNA implementation

License:

MIT https://raw.github.com/Waffle/waffle/master/LICENSE
File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-jna/pom.xml

Referenced In Project/Scope: waffle-jetty
com.github.waffle:waffle-jna:3.6.0-SNAPSHOT is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-jetty@3.6.0-SNAPSHOT

Identifiers

  • pkg:maven/com.github.waffle/waffle-jna@3.6.0-SNAPSHOT   (Confidence:Highest)

ecj-3.44.0.jar

Description:

Eclipse Compiler for Java(TM)

License:

EPL-2.0: https://www.eclipse.org/legal/epl-2.0/
File Path: /home/runner/.m2/repository/org/eclipse/jdt/ecj/3.44.0/ecj-3.44.0.jar
MD5: 8d0d2b80bc3d9431f0bdf3037f3d5954
SHA1: a4e1c9f58954801783e1b49d2f281000f814a779
SHA256:14c46ddc2e511c46c998da728f6a80f13a689c920f3832402f7ad150f6a6188d
Referenced In Project/Scope: waffle-jetty:provided
ecj-3.44.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-jetty@3.6.0-SNAPSHOT

Identifiers

  • pkg:maven/org.eclipse.jdt/ecj@3.44.0   (Confidence:High)

error_prone_annotations-2.46.0.jar

Description:

Error Prone is a static analysis tool for Java that catches common programming mistakes at compile-time.

License:

Apache 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/errorprone/error_prone_annotations/2.46.0/error_prone_annotations-2.46.0.jar
MD5: d0dabea249c067d21d7eb997fbdf5c99
SHA1: 4ecb5d2392c38c46e6cb65e1bf60be708d97005d
SHA256:b67be81ff4b956401146e14eaf1526bc435a9480f2546e91eb45b796631a8a99
Referenced In Project/Scope: waffle-jetty:provided
error_prone_annotations-2.46.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-jetty@3.6.0-SNAPSHOT

Identifiers

  • pkg:maven/com.google.errorprone/error_prone_annotations@2.46.0   (Confidence:High)

j2objc-annotations-3.1.jar

Description:

    A set of annotations that provide additional information to the J2ObjC
    translator to modify the result of translation.

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/j2objc/j2objc-annotations/3.1/j2objc-annotations-3.1.jar
MD5: abe8bd3abff622b9a8b15c3a737aa741
SHA1: a892ca9507839bbdb900d64310ac98256cab992f
SHA256:84d3a150518485f8140ea99b8a985656749629f6433c92b80c75b36aba3b099b
Referenced In Project/Scope: waffle-jetty:provided
j2objc-annotations-3.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-jetty@3.6.0-SNAPSHOT

Identifiers

  • pkg:maven/com.google.j2objc/j2objc-annotations@3.1   (Confidence:High)

jakarta.annotation-api-3.0.0.jar

Description:

Jakarta Annotations API

License:

EPL 2.0: https://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html
File Path: /home/runner/.m2/repository/jakarta/annotation/jakarta.annotation-api/3.0.0/jakarta.annotation-api-3.0.0.jar
MD5: 7faffaab962918da4cf5ddfd76609dd2
SHA1: 54f928fadec906a99d558536756d171917b9d936
SHA256:b01f55552284cfb149411e64eabca75e942d26d2e1786b32914250e4330afaa2
Referenced In Project/Scope: waffle-jetty:provided
jakarta.annotation-api-3.0.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-jetty@3.6.0-SNAPSHOT

Identifiers

  • pkg:maven/jakarta.annotation/jakarta.annotation-api@3.0.0   (Confidence:High)
  • cpe:2.3:a:oracle:projects:3.0.0:*:*:*:*:*:*:*   (Confidence:Low)   

jakarta.el-3.0.4.jar

Description:

        Jakarta Expression Language provides a specification document, API, reference implementation and TCK 
        that describes an expression language for Java applications.

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html
File Path: /home/runner/.m2/repository/org/glassfish/jakarta.el/3.0.4/jakarta.el-3.0.4.jar
MD5: a4ff0d711c405e054f8166c2ea893e0e
SHA1: f48473482c0e3e714f87186d9305bcae30b7f5cb
SHA256:3b8d4311b47fb47d168ad4338b6649a7cc21d5066b9765bd28ebca93148064be
Referenced In Project/Scope: waffle-jetty:provided
jakarta.el-3.0.4.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-jetty@3.6.0-SNAPSHOT

Identifiers

  • pkg:maven/org.glassfish/jakarta.el@3.0.4   (Confidence:High)
  • cpe:2.3:a:eclipse:jakarta_expression_language:3.0.4:*:*:*:*:*:*:*   (Confidence:Low)   

jakarta.el-api-6.0.1.jar

Description:

        Jakarta Expression Language defines an expression language for Java applications

License:

https://www.eclipse.org/org/documents/epl-2.0/EPL-2.0.txt, https://www.gnu.org/software/classpath/license.html
File Path: /home/runner/.m2/repository/jakarta/el/jakarta.el-api/6.0.1/jakarta.el-api-6.0.1.jar
MD5: a98f097e059552a75748fcdd067e5c16
SHA1: c7c4a2eb1e40e0ff45ab5e2e52bd77d8c7a75176
SHA256:7e84b5bed49de32b79cc5e85d90b6f5adb1a953ac67283adbb41c1e297f9c605
Referenced In Project/Scope: waffle-jetty:provided
jakarta.el-api-6.0.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-jetty@3.6.0-SNAPSHOT

Identifiers

  • pkg:maven/jakarta.el/jakarta.el-api@6.0.1   (Confidence:High)
  • cpe:2.3:a:eclipse:jakarta_expression_language:6.0.1:*:*:*:*:*:*:*   (Confidence:Low)   

jakarta.servlet-api-4.0.2.jar

Description:

Java(TM) Servlet 4.0 API Design Specification

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html
File Path: /home/runner/.m2/repository/jakarta/servlet/jakarta.servlet-api/4.0.2/jakarta.servlet-api-4.0.2.jar
MD5: 75523dea16c815e4b111796ea1679b1b
SHA1: 60da427ed588aa0cf70cb6cb7209c31e83069364
SHA256:0cd32c92320ae92c8692ef326dfeef756e97760251fca0c45472f299f1c3c916
Referenced In Project/Scope: waffle-jetty:provided
jakarta.servlet-api-4.0.2.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.glassfish.web/jakarta.servlet.jsp.jstl@1.2.6

Identifiers

  • pkg:maven/jakarta.servlet/jakarta.servlet-api@4.0.2   (Confidence:High)
  • cpe:2.3:a:oracle:java_se:4.0.2:*:*:*:*:*:*:*   (Confidence:Medium)   
  • cpe:2.3:a:oracle:projects:4.0.2:*:*:*:*:*:*:*   (Confidence:Low)   

jakarta.servlet.jsp-2.3.6.jar

Description:

JavaServer Pages API

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html
File Path: /home/runner/.m2/repository/org/glassfish/web/jakarta.servlet.jsp/2.3.6/jakarta.servlet.jsp-2.3.6.jar
MD5: 16d8baeceb5503f066c61582085c75cb
SHA1: 13192d5874b787c0ce0c70b35e95181e8b683a1c
SHA256:990af769158db75833fe8b4d1e56ea778246bc3c6522d434369f1a0bcebf8582
Referenced In Project/Scope: waffle-jetty:provided
jakarta.servlet.jsp-2.3.6.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-jetty@3.6.0-SNAPSHOT

Identifiers

jakarta.servlet.jsp-api-4.0.0.jar

Description:

Jakarta Server Pages API

License:

https://www.eclipse.org/org/documents/epl-2.0/EPL-2.0.txt, https://www.gnu.org/software/classpath/license.html
File Path: /home/runner/.m2/repository/jakarta/servlet/jsp/jakarta.servlet.jsp-api/4.0.0/jakarta.servlet.jsp-api-4.0.0.jar
MD5: 6fddc938119e00e6f934c1b37120e338
SHA1: a8de3741b91ba7427306104979ab2f084e831438
SHA256:873b7d0c2b5734ef8847634299b67ce879080cdece8426147522c4db8e37c14e
Referenced In Project/Scope: waffle-jetty:provided
jakarta.servlet.jsp-api-4.0.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-jetty@3.6.0-SNAPSHOT

Identifiers

  • pkg:maven/jakarta.servlet.jsp/jakarta.servlet.jsp-api@4.0.0   (Confidence:High)

jakarta.servlet.jsp.jstl-1.2.6.jar

Description:

JavaServer Pages(TM) Standard Tag Library API

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html
File Path: /home/runner/.m2/repository/org/glassfish/web/jakarta.servlet.jsp.jstl/1.2.6/jakarta.servlet.jsp.jstl-1.2.6.jar
MD5: 7058e8ed0b161b729e6134784750d22b
SHA1: f5a092de3b2b087c14ca4b8d6f2c77a1f6802828
SHA256:3b697c6cdf4d28de185e07d63f3682728b5a2b1dd229f5f9deb9b930d64b484a
Referenced In Project/Scope: waffle-jetty:provided
jakarta.servlet.jsp.jstl-1.2.6.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-jetty@3.6.0-SNAPSHOT

Identifiers

jakarta.servlet.jsp.jstl-api-1.2.4.jar

Description:

JavaServer Pages(TM) Standard Tag Library API

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html
File Path: /home/runner/.m2/repository/jakarta/servlet/jsp/jstl/jakarta.servlet.jsp.jstl-api/1.2.4/jakarta.servlet.jsp.jstl-api-1.2.4.jar
MD5: 5b4683c3a614b37a5de721817e792024
SHA1: 9d23cda192df1192894277fd9d0710abb61329af
SHA256:57122ab0151f82e716d825e65627e8064eb108dbeaafafa780687d61d5359454
Referenced In Project/Scope: waffle-jetty:provided
jakarta.servlet.jsp.jstl-api-1.2.4.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.glassfish.web/jakarta.servlet.jsp.jstl@1.2.6

Identifiers

jetty-io-12.1.5.jar

Description:

Jetty module for Core :: IO

License:

EPL-2.0 OR Apache-2.0
https://www.eclipse.org/legal/epl-2.0/, https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/eclipse/jetty/jetty-io/12.1.5/jetty-io-12.1.5.jar
MD5: 7dc223f8ff9aa14da8de2c4802153215
SHA1: de8db8fc9b571209b9d46321acf920238e02c143
SHA256:9c388018412d9bd9a1b9c35ca373e25fd845706f82549f2a7039ae9fefb45e69
Referenced In Project/Scope: waffle-jetty:provided
jetty-io-12.1.5.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.eclipse.jetty/jetty-client@12.1.5

Identifiers

jetty-server-12.1.5.jar

Description:

The legacy jetty server artifact.

License:

EPL-2.0 OR Apache-2.0
https://www.eclipse.org/legal/epl-2.0/, https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/eclipse/jetty/jetty-server/12.1.5/jetty-server-12.1.5.jar
MD5: f56663610098daa47c5138401a5762fe
SHA1: df890fa50e1de86bb130113a59baf874d647b5dd
SHA256:e0964741f132de3bdb48ca59c4b9bb8555f966d46b660c8c88f1e157cedbaa02
Referenced In Project/Scope: waffle-jetty:provided
jetty-server-12.1.5.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-servlet@12.1.5

Identifiers

jetty-servlet-api-4.0.6.jar

Description:

Combined servlet api and schemas for use in JPMS and OSGi environments

License:

http://www.apache.org/licenses/LICENSE-2.0, http://www.eclipse.org/org/documents/epl-v10.php
File Path: /home/runner/.m2/repository/org/eclipse/jetty/toolchain/jetty-servlet-api/4.0.6/jetty-servlet-api-4.0.6.jar
MD5: d63413e02885c25d0129e3d2936606f6
SHA1: 959c5d83d08f5cddf56caff749e48b735193191b
SHA256:d90bf1f8a9d2ba89f4510bb51e1516dcf94ef6dc034e00f233654abdd78f2210
Referenced In Project/Scope: waffle-jetty:provided
jetty-servlet-api-4.0.6.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-apache-jsp@12.1.5

Identifiers

  • pkg:maven/org.eclipse.jetty.toolchain/jetty-servlet-api@4.0.6   (Confidence:High)

jna-5.18.1.jar

Description:

Java Native Access

License:

LGPL-2.1-or-later: https://www.gnu.org/licenses/old-licenses/lgpl-2.1
Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/net/java/dev/jna/jna/5.18.1/jna-5.18.1.jar
MD5: cb531ec131e1c68c045b5d45fe5b9878
SHA1: b27ba04287cc4abe769642fe8318d39fc89bf937
SHA256:260c4b1e22b1db9e110ee441c4f13ce115f841fa48c41d78750986214b395557
Referenced In Project/Scope: waffle-jetty:compile
jna-5.18.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-jna@3.6.0-SNAPSHOT

Identifiers

  • pkg:maven/net.java.dev.jna/jna@5.18.1   (Confidence:High)
  • cpe:2.3:a:oracle:java_se:5.18.1:*:*:*:*:*:*:*   (Confidence:Low)   

jna-5.18.1.jar: jnidispatch.dll

File Path: /home/runner/.m2/repository/net/java/dev/jna/jna/5.18.1/jna-5.18.1.jar/com/sun/jna/win32-aarch64/jnidispatch.dll
MD5: 302945a811fd8e21bcdd5226c73b6f74
SHA1: 6b05e299ff2b3eb3b7b7aeac44263f715693607c
SHA256:b8f98be314234cf12b5b46c29652f70c0f6abb93ae19b63d3fe2692062aa699d
Referenced In Project/Scope: waffle-jetty:compile

Identifiers

  • None

jna-5.18.1.jar: jnidispatch.dll

File Path: /home/runner/.m2/repository/net/java/dev/jna/jna/5.18.1/jna-5.18.1.jar/com/sun/jna/win32-x86-64/jnidispatch.dll
MD5: 2d2475f1f026dd54e9f3e787ae4f81da
SHA1: 27ff882ac271db547aee520b38e3ba9aa91e136c
SHA256:5a7ff949f6d93d86491eb5b26b1cfc60051168a60622650224b89995ac420023
Referenced In Project/Scope: waffle-jetty:compile

Identifiers

  • None

jna-5.18.1.jar: jnidispatch.dll

File Path: /home/runner/.m2/repository/net/java/dev/jna/jna/5.18.1/jna-5.18.1.jar/com/sun/jna/win32-x86/jnidispatch.dll
MD5: 0caa1ef75a807f9dde05084fa2219a5c
SHA1: 2f5e1cd82cde192905c7510ce99037b67d980640
SHA256:752d597cee7e95cb517327146bf42f124c0d6c0bc48b3ecc3b1b3b0531a52f44
Referenced In Project/Scope: waffle-jetty:compile

Identifiers

  • None

jna-platform-5.18.1.jar

Description:

Java Native Access Platform

License:

LGPL-2.1-or-later: https://www.gnu.org/licenses/old-licenses/lgpl-2.1
Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/net/java/dev/jna/jna-platform/5.18.1/jna-platform-5.18.1.jar
MD5: a7af00779ec98bfe22dfb07b1532830d
SHA1: dd817f391efc492041c9ae91127527c13750a789
SHA256:ad14c1b1ec4f43d396231219dfa635ebf828f738eac9f890ea1bc07795892d9a
Referenced In Project/Scope: waffle-jetty:compile
jna-platform-5.18.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-jna@3.6.0-SNAPSHOT

Identifiers

  • pkg:maven/net.java.dev.jna/jna-platform@5.18.1   (Confidence:High)

jspecify-1.0.0.jar

Description:

An artifact of well-named and well-specified annotations to power static analysis checks

License:

The Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/jspecify/jspecify/1.0.0/jspecify-1.0.0.jar
MD5: 9133aba420d0ca3b001dbb6ae9992cf6
SHA1: 7425a601c1c7ec76645a78d22b8c6a627edee507
SHA256:1fad6e6be7557781e4d33729d49ae1cdc8fdda6fe477bb0cc68ce351eafdfbab
Referenced In Project/Scope: waffle-jetty:compile
jspecify-1.0.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.junit.jupiter/junit-jupiter-engine@6.0.2

Identifiers

  • pkg:maven/org.jspecify/jspecify@1.0.0   (Confidence:High)

jsr305-3.0.2.jar

Description:

JSR305 Annotations for Findbugs

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.jar
MD5: dd83accb899363c32b07d7a1b2e4ce40
SHA1: 25ea2e8b0c338a877313bd4672d3fe056ea78f0d
SHA256:766ad2a0783f2687962c8ad74ceecc38a28b9f72a2d085ee438b7813e928d0c7
Referenced In Project/Scope: waffle-jetty:provided
jsr305-3.0.2.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.spotbugs/spotbugs-annotations@4.9.8

Identifiers

  • pkg:maven/com.google.code.findbugs/jsr305@3.0.2   (Confidence:High)

mortbay-apache-el-9.0.111.jar

Description:

A rebundling of Apache Tomcat Jasper to remove the tomcat server dependencies,    so that the JSP engine can be used by the Eclipse Jetty project.

License:

http://www.apache.org/licenses/LICENSE-2.0
File Path: /home/runner/.m2/repository/org/mortbay/jasper/mortbay-apache-el/9.0.111/mortbay-apache-el-9.0.111.jar
MD5: 2b45155ffc38a4fe5d79ec6b4faafc32
SHA1: c374c62a07578442e4a649c8a5d01cac082685bf
SHA256:c1773366f32e50addf14f6fb1ea4da28547f0373389e093883664d36ec5e83a1
Referenced In Project/Scope: waffle-jetty:provided
mortbay-apache-el-9.0.111.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-apache-jsp@12.1.5

Identifiers

  • pkg:maven/org.mortbay.jasper/mortbay-apache-el@9.0.111   (Confidence:High)
  • cpe:2.3:a:eclipse:jetty:9.0.111:*:*:*:*:*:*:*   (Confidence:Low)   
  • cpe:2.3:a:jetty:jetty:9.0.111:*:*:*:*:*:*:*   (Confidence:Low)   
  • cpe:2.3:a:mortbay:jetty:9.0.111:*:*:*:*:*:*:*   (Confidence:Low)   
  • cpe:2.3:a:mortbay_jetty:jetty:9.0.111:*:*:*:*:*:*:*   (Confidence:Low)   

CVE-2017-7657  

In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), CWE-190 Integer Overflow or Wraparound

CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A
CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2017-7658  

In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A
CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2017-7656  

In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), NVD-CWE-noinfo

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:3.9/RC:R/MAV:A
CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2017-9735  

Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.
CWE-203 Observable Discrepancy

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:3.9/RC:R/MAV:A
CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2021-28165  

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
CWE-400 Uncontrolled Resource Consumption, CWE-755 Improper Handling of Exceptional Conditions, CWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A
CVSSv2:
  • Base Score: HIGH (7.8)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:C

References:

Vulnerable Software & Versions: (show all)

CVE-2022-2048  

In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.
CWE-664 Improper Control of a Resource Through its Lifetime, NVD-CWE-Other, CWE-410 Insufficient Resource Pool

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A
CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2023-44487  

CISA Known Exploited Vulnerability:
  • Product: IETF HTTP/2
  • Name: HTTP/2 Rapid Reset Attack Vulnerability
  • Date Added: 2023-10-10
  • Description: HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).
  • Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
  • Due Date: 2023-10-31
  • Notes: This vulnerability affects a common open-source component, third-party library, or protocol used by different products. For more information, please see: HTTP/2 Rapid Reset Vulnerability, CVE-2023-44487 | CISA: https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487; https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/; https://nvd.nist.gov/vuln/detail/CVE-2023-44487

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CWE-400 Uncontrolled Resource Consumption, NVD-CWE-noinfo

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2024-9823  

There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the server using DosFilter. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory finally.
CWE-400 Uncontrolled Resource Consumption

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2020-27216  

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.
CWE-378 Creation of Temporary File With Insecure Permissions, CWE-379 Creation of Temporary File in Directory with Insecure Permissions, NVD-CWE-Other

CVSSv3:
  • Base Score: HIGH (7.0)
  • Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:1.0/RC:R/MAV:A
CVSSv2:
  • Base Score: MEDIUM (4.4)
  • Vector: /AV:L/AC:M/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2018-12536  

In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, the InvalidPathException message is included in the error response, revealing the full server path to the requesting system.
CWE-209 Generation of Error Message Containing Sensitive Information, NVD-CWE-noinfo

CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:3.9/RC:R/MAV:A
CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2021-28169  

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
NVD-CWE-Other, CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:3.9/RC:R/MAV:A
CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2023-26048  

Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request with a part that has a name but no filename and very large content. This happens even with the default settings of `fileSizeThreshold=0` which should stream the whole part content to disk. An attacker client may send a large multipart request and cause the server to throw `OutOfMemoryError`. However, the server may be able to recover after the `OutOfMemoryError` and continue its service -- although it may take some time. This issue has been patched in versions 9.4.51, 10.0.14, and 11.0.14. Users are advised to upgrade. Users unable to upgrade may set the multipart parameter `maxRequestSize` which must be set to a non-negative value, so the whole multipart content is limited (although still read into memory).
CWE-400 Uncontrolled Resource Consumption, CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:3.9/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2023-26049  

Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with `"` (double quote), it will continue to read the cookie string until it sees a closing quote -- even if a semicolon is encountered. So, a cookie header such as: `DISPLAY_LANGUAGE="b; JSESSIONID=1337; c=d"` will be parsed as one cookie, with the name DISPLAY_LANGUAGE and a value of b; JSESSIONID=1337; c=d instead of 3 separate cookies. This has security implications because if, say, JSESSIONID is an HttpOnly cookie, and the DISPLAY_LANGUAGE cookie value is rendered on the page, an attacker can smuggle the JSESSIONID cookie into the DISPLAY_LANGUAGE cookie and thereby exfiltrate it. This is significant when an intermediary is enacting some policy based on cookies, so a smuggled cookie can bypass that policy yet still be seen by the Jetty server or its logging system. This issue has been addressed in versions 9.4.51, 10.0.14, 11.0.14, and 12.0.0.beta0 and users are advised to upgrade. There are no known workarounds for this issue.
NVD-CWE-noinfo, CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:3.9/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2023-40167  

Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field.  This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses.  There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario.
CWE-130 Improper Handling of Length Parameter Inconsistency, NVD-CWE-noinfo

CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:3.9/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2024-6763  

Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.

The HttpURI class does insufficient validation on the authority segment of a URI.  However the behaviour of HttpURI
 differs from the common browsers in how it handles a URI that would be 
considered invalid if fully validated against the RRC.  Specifically HttpURI
 and the browser may differ on the value of the host extracted from an 
invalid URI and thus a combination of Jetty and a vulnerable browser may
 be vulnerable to a open redirect attack or to a SSRF attack if the URI 
is used after passing validation checks.
CWE-1286 Improper Validation of Syntactic Correctness of Input, NVD-CWE-Other

CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:3.9/RC:R/MAV:A

References:

Vulnerable Software & Versions:

CVE-2021-34428  

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.
CWE-613 Insufficient Session Expiration

CVSSv3:
  • Base Score: LOW (3.5)
  • Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:0.9/RC:R/MAV:A
CVSSv2:
  • Base Score: LOW (3.6)
  • Vector: /AV:L/AC:L/Au:N/C:P/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2023-36479  

Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.
CWE-149 Improper Neutralization of Quoting Syntax, NVD-CWE-Other

CVSSv3:
  • Base Score: LOW (3.1)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:1.6/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2022-2047  

In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: LOW (2.7)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N/E:1.2/RC:R/MAV:A
CVSSv2:
  • Base Score: MEDIUM (4.0)
  • Vector: /AV:N/AC:L/Au:S/C:N/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

mortbay-apache-jsp-9.0.111.jar

Description:

A rebundling of Apache Tomcat Jasper to remove the tomcat server dependencies,    so that the JSP engine can be used by the Eclipse Jetty project.

License:

http://www.apache.org/licenses/LICENSE-2.0
File Path: /home/runner/.m2/repository/org/mortbay/jasper/mortbay-apache-jsp/9.0.111/mortbay-apache-jsp-9.0.111.jar
MD5: 53d6741c3b444ae10b24f81ca5fc852e
SHA1: 2cf7435e457cc56404832a4b6963312be8a6a53b
SHA256:b81fa4e3646b7c92291b5c962ac3bbbb60a13298a8f4d5d9a6a2bc0a1fcbc5fb
Referenced In Project/Scope: waffle-jetty:provided
mortbay-apache-jsp-9.0.111.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-apache-jsp@12.1.5

Identifiers

  • pkg:maven/org.mortbay.jasper/mortbay-apache-jsp@9.0.111   (Confidence:High)
  • cpe:2.3:a:apache:tomcat:9.0.111:*:*:*:*:*:*:*   (Confidence:Low)   

slf4j-api-2.0.17.jar

Description:

The slf4j API

License:

https://opensource.org/license/mit
File Path: /home/runner/.m2/repository/org/slf4j/slf4j-api/2.0.17/slf4j-api-2.0.17.jar
MD5: b6480d114a23683498ac3f746f959d2f
SHA1: d9e58ac9c7779ba3bf8142aff6c830617a7fe60f
SHA256:7b751d952061954d5abfed7181c1f645d336091b679891591d63329c622eb832
Referenced In Project/Scope: waffle-jetty:compile
slf4j-api-2.0.17.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-jna@3.6.0-SNAPSHOT

Identifiers

  • pkg:maven/org.slf4j/slf4j-api@2.0.17   (Confidence:High)

spotbugs-annotations-4.9.8.jar

Description:

Annotations the SpotBugs tool supports

License:

GNU LESSER GENERAL PUBLIC LICENSE, Version 2.1: https://www.gnu.org/licenses/old-licenses/lgpl-2.1.en.html
File Path: /home/runner/.m2/repository/com/github/spotbugs/spotbugs-annotations/4.9.8/spotbugs-annotations-4.9.8.jar
MD5: d4c2e7bd090be697ad409a4e75684a94
SHA1: ca4a2783a6123e67124fd7feb4caccd2e2ac9a73
SHA256:6f69d6fe9c55a54dcb30e87d8fa2d5f52246af50d7a3445246d9539ef221be1c
Referenced In Project/Scope: waffle-jetty:provided
spotbugs-annotations-4.9.8.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-jetty@3.6.0-SNAPSHOT

Identifiers

  • pkg:maven/com.github.spotbugs/spotbugs-annotations@4.9.8   (Confidence:High)


This report contains data retrieved from the National Vulnerability Database.
This report may contain data retrieved from the CISA Known Exploited Vulnerability Catalog.
This report may contain data retrieved from the Github Advisory Database (via NPM Audit API).
This report may contain data retrieved from RetireJS.
This report may contain data retrieved from the Sonatype OSS Index.